> <html><body>
> <center><!--sriwQlj8pV75--><a href="http://www.sortffr.com";><img
src="http://www.rockedce.com/v9.gif"; border=0></a></center>
> <body></html>

You might want to try this too:

uri       AMB_IMAGE_CONTENT  /\/[a-z][a-z]?[0-9][0-9]?\.(gif|jpg)/i
describe  AMB_IMAGE_CONTENT  Contains a URI linking to a numbered gif/jpg
score     AMB_IMAGE_CONTENT  3.0

Note that my default score is quite high.  I get no problems from this,
but if you subscribe to a lot of HTML lists you may have a problem with
false positives so I'd start with a lower score if that's the case or use
some judicious whitelisting to cancel out the FPs.

Andy

Reply via email to